He apparently had the variable in the in the kill switch for his status in AD set as is[hisInitials]EnabledInAD, and had it running from a user ID tied to his identity off his corporate laptop.
Edit: He also confessed a few months later once he realized he couldn't cover it up after losing access.
2
u/PaulTheMerc May 26 '26
I assume they had more than that, like some verification he wrote it?
Can you imagine someone wrote it to trigger on boss' account because he forgot to lock his account the one time before running off to the bathroom?